Downloaded files that are not readable by the ACL

Question

I am currently working on an application running in GAE that will accept an image upload and then write it to the repository with the GCS client library (previously used the cloud storage API with the same results). The problem that I see is that after writing it, files are only available if you are already logged in with a Google account. I have billing enabled, and my GAE identifier ( [e-mail] ) is added as a team member to the Google API project as the owner.

I used the command: gsutil setdefacl public-read gs://mybucket (file name in real-time code).

I have the following entry in my ACL:

 <Entry> <Scope type="AllUsers"/> <Permission> READ </Permission> </Entry> 

And I initialize the entry with this code:

 GcsService gcsService = GcsServiceFactory.createGcsService(); GcsFilename filename = new GcsFilename(bucket, fileName); GcsFileOptions options = new GcsFileOptions.Builder() .mimeType(mime) .acl("public-read").build(); GcsOutputChannel writeChannel = gcsService.createOrReplace(filename, options); 

The application returns the file URL to the client, which, as I mentioned, is great for any Google user, but any other user is redirected when trying to access https://storage.cloud.google.com/mybucket/filename.png . Also, when I entered the cloud storage web interface, when I insert a box in the “SHARED PUBLICLY” column (which has a dash in it), I get the message “You do not have permission to view or edit this ACL object,”. However, I can delete the file without problems, and the account I logged in with is set up as the owner of the API project.

I am sure that I am missing something easy here, but I was on all the documents and worked on it for a couple of days. Any insight is greatly appreciated.

Answer 1

Open Release Question

The storage.cloud.google.com domain storage.cloud.google.com used by the cloud storage interface, which is available only for logging in. This is not an API endpoint. You must use https://storage.googleapis.com/bucketname/objectname or https://bucketname.storage.googleapis.com/objectname .

Permission denied for editing ACL

Only a user with a FULL_CONTROL object or object owner can view the object ACL. It looks like the object belongs to your service account, and your account does not have a FULL_CONTROL object, so it cannot view ACLs. You can still delete the object, because a user with FULL_CONTROL in the bucket always has the ability to delete objects in the bucket.

Answer 2

Related Note. I think you can reduce the cost of the processor by using the blobstore API directly to upload the image to GCS. https://developers.google.com/appengine/docs/java/blobstore/#using-blobstore-with-gcs